INFORMATION SECURITY SYSTEMS AND METHODS

• US 20170195370A1
• Filed: 02/14/2017
• Published: 07/06/2017
• Est. Priority Date: 04/11/2011
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: CAREY, W. Knox, NILSSON, Jarl
• Granted Patent: US 10,009,384 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for governing derived electronic resources are provided. In one embodiment, a digital resource is associated with one or more rules and a set of one or more computations, wherein the rules correspond to one or more conditions for accessing the digital resource and the computations operate upon the digital resource in order to provide a specific view of the digital resource that differs from the digital resource.

Claims

1-26. -26. (canceled)

27. A method for governing the use of a digital resource, the method comprising:

receiving one or more programs associated with at least one user, wherein the one or more programs are configured to operate upon the digital resource when executed to generate a derived digital resource by performing at least one computation on information contained in the digital resource;

associating one or more rules with the digital resource, wherein the rules correspond to one or more conditions for accessing the digital resource;

associating the one or more programs with the digital resource; and

receiving a request to generate the derived digital resource from a system associated with the at least one user;

executing the one or more programs to generate the derived digital resource based on the digital resource, wherein the at least one computation comprises a computation that obscures at least a portion of the digital resource when executed to the generate the derived digital resource such that the digital resource contains information that is not included in the generated derived digital resource, and wherein executing the one or more programs comprises enforcing the one or more conditions for accessing the digital resource in connection with execution of the one or more programs; and

transmitting the derived digital resource to the system associated with the at least one user.

28. The method of claim 27, wherein the computation that obscures the at least a portion of the digital resource comprises a hashing computation.

29. The method of claim 27, wherein the computation that obscures that at least a portion of the digital resource comprises a computation that performs a mathematical transformation on the at least a portion of the digital resource.

30. The method of claim 29, wherein the mathematical transformation comprises calculating an average of the at least a portion of the digital resource.

31. The method of claim 29, wherein the mathematical transformation comprises transforming the at a least a portion of the digital resource to a specified resolution.

32. The method of claim 27, wherein the computation that obscures the at least a portion of the digital resource obscures the at least a portion of the digital resource based in part on obfuscation information.

33. The method of claim 32, wherein the obfuscation information comprises randomly generated information.

34. The method of claim 32, wherein the obfuscation information comprises pseudorandomly generated information.

35. The method of claim 32, wherein the obfuscation information is determined based on deterministic seed information such that a same principal receives a same generated derived digital resource.

36. The method of claim 27, in which the at least one program is associated with a set of users rather than an individual user.

37. The method of claim 36, in which the set of users is specified by explicitly listing the users for whom the at least one program applies.

38. The method of claim 36, in which the set of users is specified by providing an attribute common to the set of users, such that the at least one program is required for any user to whom said attribute applies.

39. The method of claim 27, in which the generated derived resource is dependent upon the at least one user, a set of users, or another principal to whom the at least one program applies.

40. The method of claim 27, further comprising:

receiving a new set of programs configured to operate upon the digital resource; and

receiving a request for associating the new set of programs with the digital resource.

41. The method of claim 38, further comprising:

approving the request for associating the new set of programs with the digital resource.

42. The method of claim 27, further comprising:

cryptographically associating the one or more programs with the digital resource.

43. The method of claim 42, in which the association is made by creating a digitally signed document consisting of the pairing of a unique representation of the digital resource and a unique representation of the one or more programs to be associated with the digital resource.

44. The method of claim 43, in which the representation of the digital resource is the result of applying a one-way function.

45. The method of claim 43, in which the representation of the digital resource is a unique identifier associated with the digital resource.

46. The method of claim 45, in which the unique identifier associated with the digital resource was assigned by a trusted third party.